What’s New Wednesday: Patch Tuesday September 2025 September 10, 2025 – Posted in: IT Support, What's New Wednesdays – Tags: cybersecurity, ITSupport, Patch Tuesday, patching, WhatsNewWednesday

Welcome to Patch Tuesday September 2025, 81 flaws were patched including two publicly disclosed zero-day vulnerabilities. It’s a good idea to restart your PC today, and we may restart some of your servers overnight this week if a patch requires it.

NEW THIS WEDNESDAY

Overall Microsoft patched:

• 41 Elevation of Privilege Vulnerabilities
• 2 Security Feature Bypass Vulnerabilities
• 22 Remote Code Execution Vulnerabilities
• 16 Information Disclosure Vulnerabilities
• 3 Denial of Service Vulnerabilities
• 1 Spoofing Vulnerability

There were two publicly disclosed zero-day vulnerabilities patched:
CVE-2025-55234 – Windows SMB Elevation of Privilege Vulnerability
An elevation of privileges flaw in SMB Server that’s exploited through relay attacks. Windows already includes settings to harden the SMB server against relay attacks, but enabling these features could cause compatibility issues with older systems.
CVE-2024-21907 – VulnCheck: CVE-2024-21907 Improper Handling of Exceptional Conditions in Newtonsoft.Json
A mishandling of exceptional conditions vulnerability in Newtonsoft.Json before version 13.0.1. Depending on the usage of the library, an attacker may be able to cause the denial of service condition.

Releases from other software providers include:

• Abobe – updates for a “SessionReaper” flaw impacting Magento eCommerce stores.
• Argo – fixed an Argo CD vulnerability that allows low-privileged API tokens to access API endpoints.
• Cisco – patched WebEx, Cisco ASA, and other products.
• Google – September Android security updates that address a total of 84 vulnerabilities, including two actively exploited flaws.
• SAP – updates for multiple products, including a fix for a maximum severity command execution bug in Netweaver.
• Sitecore – updates for a zero day vulnerability tracked as CVE-2025-53690 that was actively exploited in attacks.
• TP-Link – confirmed a new zero-day exists in some of its routers, they are exploring its exploitability and creating patches for US customers.

FULL LIST OF KNOWN PATCHES

Reminder: Windows 10, Office 2016 and 2019, and Exchange 2016 and 2019 are Going Out of Support in October 2025!

We’re getting close now to the October 2025 deadline. If you have an on-prem mail server, Windows 10 machines or are using boxed copies of Office 2016 or 2019 give us a call now to discuss your options. You can learn more in our Windows 10 article and find out what your options are for on-prem mail servers here.

GLOSSARY

• Authentication – proving who you are so you can be given access to what you need/have rights to.
• MFA – multi-factor authentication, proving who you are in multiple ways, something you know (like a password or pin), something you are (a fingerprint or retina scan), something you have (like your phone – proved with a code).
• Vulnerability – a defect in software that could allow an attacker to gain control of a system or service.
• Patch – a change to a piece of software, released after sale, to fix a problem or add a feature.
• Zero Day – Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.
• Actively Exploited – an actively exploited vulnerability is one that is being used by malicious actors.
• DDOS / DOS – (Distributed) Denial of Service attack, a method of swamping a service or server with so many false queries at once that it is forced offline.
• Disclosed – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• CVE ID – CVE, short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws, the ID is the number assigned to that vulnerability.
• Severity – a disclosed vulnerability is one that the software creators have published, meaning that it can be easily found out about by anyone who knows where to look.
• Security Feature Bypass Vulnerabilities – allow for intruders to bypass security features such as password protection or MFA.
• Remote Code Execution Vulnerabilities – allow people to remotely trigger potentially malicious code on your device.
• Information Disclosure Vulnerabilities – allow the wrong people access to your data.
• Denial of Service Vulnerabilities – allow a DOS/DDOS attack to succeed.
• Spoofing Vulnerabilities – allow someone to pretend to be you/your systems.

If you have any concerns about cybersecurity, or would like to discuss any other IT Support needs you might have please give us a call on 01245 265100 or email us at . To stay up to date with our regular What’s New Wednesday emails and receive industry news straight to your inbox, subscribe to our newsletters in the top right.